黑客如何在2分钟内入侵一台安卓电视

Bookmark(1)

Hacking an Android TV in 2 minutes

黑客如何在2分钟内入侵一台安卓电视

TVoodoo: Hacking a Sony Android TV abusing of infrared

TVoodoo:黑客使用Sony安卓电视的红外线

Author: Valerio Mulas
Linkedin: https://linkedin.com/in/valerio-mulas
Twitter: https://twitter.com/drakkars
Video: https://www.youtube.com/watch?v=qpdVk7Vv-C8
Abstract

作者:Valerio Mulas
视频内容如下:

The number of IoT devices connected to the Internet is growing exponentially. In 2015 the number was around 15 billion units and the forecast for 2025 points to an estimated 75 billion.

前言:
连接到互联网的物联网设备数量呈级数递增。到2025年,全球物联网(IoT)连接设备 的总安装量预计将达到754.4亿,十年内增长五倍。物联网由已经无处不在的互联网技术支持,是实现互联网使世界成为互联世界的承诺的下一个主要步骤。

Currently — in 2019 — the number of IoT devices is estimated to be around 23 billion.
(source: https://www.statista.com/statistics/471264/iot-number-of-connected-devices-worldwide)

目前2019年接入网络的物联网设备约为230亿台。
统计报告来自:Statista 消费类电子产品报告 https://www.statista.com/statistics/471264/iot-number-of-connected-devices-worldwide/

A portion of these impressive volumes consists of Android-based Smart TVs, Android TV Boxes, Amazon Echo, Amazon Fire and Amazon Key devices.

这个庞大的设备量包含了一部分的Android安卓智能电视,智能电视盒,Amazon Echo,Amazon Fire和Amazon Key设备

This paper announces and describes a new attack vector targeting Android Smart TVs over Infrared communication.
The process of building the attack will show how to simulate a remote control in order to automate a set of malicious steps to take over a Smart TV.
The PoC will also describe some atypical lateral movement scenarios.
Table of Content

本文主要是介绍了利用红外通信针对安卓电视的攻击。Android Smart TV,通过模拟遥控器操作,来接管智能电视,POC也将描述一些非典型的横向运动场景。

1.Initial setup
2.Getting to know the Android Smart TV
2.1. Mapping the control
2.2. Poor Man Mobile Testing
2.3. Payloads, lots of payloads
Infrared Rubber Ducky
TVoodoo Attack
The malware PoC
Lateral Movements, Rogue and more
6.1. Mining
6.2. Pivoting and Botnet
6.3. AWS Transcribe
6.4. Amazon Echo
6.4.1. Buy me {{ item }} plz
6.4.2. Amazon Key
6.4.3. Location, Location, Location
Mitigation measures
Further/Future developments
8.1. TVoodoo App
8.2. Payload Store
8.3. Drone
8.4. Lateral movement via Infrared camera
Conclusion

  1. 安装
  2. 认识电视内置安卓系统
    2.1 映射控件
    2.2 红外手机连接测试
    2.3 有效载荷和最大载荷
  3. 红外线鸭子攻击
头像 By 大胖子

Your sidebar area is currently empty. Hurry up and add some widgets.